24x7x365 Los Angeles Urgent Crypto-Ransomware
Virus Assessment and Repair Experts

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for organizations vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and continue to inflict damage. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as additional as yet unnamed viruses, not only encrypt on-line files but also infect all configured system protection mechanisms. Data synched to off-site disaster recovery sites can also be encrypted. In a poorly designed environment, this can make automatic recovery hopeless and basically knocks the entire system back to square one.

Recovering services and data after a ransomware outage becomes a race against time as the targeted organization struggles to contain, cleanup the crypto-ransomware, and restore mission-critical operations. Due to the fact that ransomware takes time to move laterally, penetrations are usually launched on weekends, when successful attacks may take longer to recognize. This multiplies the difficulty of quickly mobilizing and orchestrating a qualified mitigation team.

Progent offers a range of solutions for protecting enterprises from ransomware penetrations. These include staff training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with machine learning technology from SentinelOne to detect and suppress new threats quickly. Progent also offers the assistance of seasoned crypto-ransomware recovery professionals with the talent and perseverance to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Recovery Services
After a ransomware invasion, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the codes to decipher any or all of your files. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the essential components of your Information Technology environment. Without access to complete information backups, this requires a wide range of skills, well-coordinated project management, and the capability to work non-stop until the task is done.

For two decades, Progent has offered certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded top certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of experience gives Progent the skills to efficiently determine important systems and consolidate the remaining pieces of your IT system following a crypto-ransomware event and assemble them into an operational network.

Progent's security team utilizes state-of-the-art project management systems to coordinate the complex recovery process. Progent appreciates the urgency of acting rapidly and together with a customer's management and Information Technology team members to assign priority to tasks and to put essential systems back on line as soon as possible.

Business Case Study: A Successful Ransomware Virus Restoration
A business hired Progent after their company was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored criminal gangs, possibly using techniques exposed from the U.S. National Security Agency. Ryuk attacks specific companies with little or no ability to sustain operational disruption and is one of the most lucrative examples of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area with around 500 workers. The Ryuk penetration had brought down all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding $200K) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the client to rapidly understand and prioritize the essential areas that had to be restored in order to restart business functions:

• Windows Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery of needed systems. All Exchange data and attributes were usable, which accelerated the restore of Exchange. Progent was able to locate local OST data files (Microsoft Outlook Off-Line Folder Files) on various desktop computers in order to recover mail messages. A recent off-line backup of the customer's accounting/ERP systems made it possible to recover these required applications back available to users. Although major work was left to recover completely from the Ryuk event, critical systems were recovered rapidly:

Over the next few weeks critical milestones in the recovery project were accomplished in close cooperation between Progent consultants and the client:

• In-house web applications were restored without losing any data.
• The MailStore Server containing more than 4 million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were 100 percent restored.
• A new Palo Alto 850 security appliance was set up and programmed.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A possible business-ending catastrophe was dodged by hard-working experts, a wide range of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware attack detailed here should have been disabled with current security technology solutions and best practices, user education, and properly executed incident response procedures for data protection and proper patching controls, the fact remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware penetration, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, cleanup, and file disaster recovery.

To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Los Angeles a range of online monitoring and security evaluation services to assist you to minimize the threat from crypto-ransomware. These services utilize modern AI technology to detect new variants of ransomware that are able to get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network expands easily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to help keep your IT system running at peak levels by tracking the state of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your specified IT personnel and your assigned Progent engineering consultant so that any potential problems can be resolved before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for streamlining common tedious tasks. These include health checking, update management, automated repairs, endpoint setup, backup and restore, A/V defense, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your specified IT management personnel and your Progent technical consultant so potential problems can be taken care of before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller businesses to diagram, track, optimize and debug their connectivity hardware such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology maps are always updated, captures and displays the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, finding appliances that require important updates, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth management reporting tools created to integrate with the top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to create ProSight Data Protection Services, a selection of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your backup processes and enable transparent backup and fast recovery of critical files, applications, images, and VMs. ProSight DPS helps you recover from data loss resulting from hardware failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, malicious insiders, or software bugs. Managed services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security vendors to deliver centralized management and comprehensive protection for your email traffic. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. Email Guard's cloud filter serves as a first line of defense and keeps most unwanted email from reaching your network firewall. This reduces your exposure to external attacks and saves network bandwidth and storage. Email Guard's on-premises gateway appliance provides a further level of analysis for inbound email. For outbound email, the on-premises gateway provides AV and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also assist Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication. Duo enables single-tap identity verification on iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you sign into a secured application and enter your password you are requested to confirm your identity via a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized as this second form of ID validation including a smartphone or watch, a hardware token, a landline telephone, etc. You can register several verification devices. To learn more about ProSight Duo two-factor identity validation services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Help Center services allow your information technology team to outsource Help Desk services to Progent or divide activity for Service Desk support transparently between your internal network support team and Progent's nationwide roster of certified IT support engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your core IT support staff. Client access to the Help Desk, delivery of technical assistance, escalation, trouble ticket creation and tracking, performance metrics, and management of the service database are consistent whether issues are resolved by your in-house support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior-based machine learning tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a single platform to manage the complete malware attack progression including blocking, identification, containment, remediation, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and safeguard data related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as half of time thrown away trying to find vital information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a flexible and affordable solution for evaluating, validating, scheduling, implementing, and tracking updates to your dynamic information network. In addition to maximizing the security and reliability of your IT network, Progent's patch management services permit your IT team to concentrate on line-of-business projects and activities that deliver maximum business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a fast virtual host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely evade traditional signature-matching AV products. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a unified platform to address the complete malware attack lifecycle including blocking, identification, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering via leading-edge technologies packaged within one agent managed from a single console. Progent's data protection and virtualization consultants can assist your business to design and implement a ProSight ESP deployment that addresses your organization's specific requirements and that helps you prove compliance with government and industry information security standards. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for immediate attention. Progent can also help you to install and test a backup and restore system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.